Downloaded certs are stored in /var/db/anvil (or DOWNLOAD_DIR).
If you remove a cert from the .conf file, cert-puller will no longer attempt to fetch that cert.
When modifying the .conf file, best practice is to run cert-puller -s and use the output to update the sudoers file (on FreeBSD, via visudo).
However, the removed cert is stashed in DOWNLOAD_DIR and you'll get sudo errors when cert-puller attempts to install that cert, because it's in DOWNLOAD_DIR
Two solutions:
-
clear DOWNLOAD_DIR upon startup
-
use the list of configured certs to walk through DOWNLOAD_DIR contents finding stuff to install.
Either should work.
The clear option starts with a fresh slate. At present, cert-puller never deletes anything in that directory. A delete will be safe because this is running as non-root.
The .conf file solution is clean because then the fetch and the install both use the same source and ignores what is on disk.
Downloaded certs are stored in
/var/db/anvil(orDOWNLOAD_DIR).If you remove a cert from the .conf file,
cert-pullerwill no longer attempt to fetch that cert.When modifying the .conf file, best practice is to run
cert-puller -sand use the output to update the sudoers file (on FreeBSD, viavisudo).However, the removed cert is stashed in
DOWNLOAD_DIRand you'll get sudo errors when cert-puller attempts to install that cert, because it's inDOWNLOAD_DIRTwo solutions:
clear
DOWNLOAD_DIRupon startupuse the list of configured certs to walk through
DOWNLOAD_DIRcontents finding stuff to install.Either should work.
The clear option starts with a fresh slate. At present,
cert-pullernever deletes anything in that directory. A delete will be safe because this is running as non-root.The .conf file solution is clean because then the fetch and the install both use the same source and ignores what is on disk.